PRIVACY POLICY AND COOKIE POLICY

I- PRIVACY POLICY

UNIBAIL MANAGEMENT and WESTFIELD EUROPE LIMITED (hereinafter together referred to as the "Competition Organiser", the "Joint Processors", or or "We"), both companies of the UNIBAIL-RODAMCO-WESTFIELD Group specialised in the management, promotion and investment of large shopping centres located in major cities in Europe and the United States, are organising, in the UK, a competition called "Westfield Grand Prix" (hereinafter the "Competition") in order to promote new sustainable business concepts created by young entrepreneurs and to support their development into tomorrow's commercial successes.

Participation in the Competition requires candidates (hereinafter the "Candidates") to create an account on the Agorize platform and to use said platform for the various stages of the Competition (hereinafter the "Participation Platform"), it being specified that Agorize will act as a subcontractor of the Joint Processors.

The Competition Organiser is particularly committed to respecting the privacy of Candidates and protecting their personal data, which it collects and processes in accordance with the national and European regulations in force, and in particular the General Data Protection Regulation (EU) 2016/679 (hereinafter "GDPR").

To this end, the purpose of this privacy policy (hereinafter the "Privacy Policy") is to detail the way in which the Joint Processors collect and process personal data in the context of the visit and/or use of the features of the Participation Platform by Candidates.

In this Privacy Policy, "Personal Data" means any information relating to an identified or identifiable natural person, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.

By browsing the Platform, Candidates acknowledge that they have read this Privacy Policy and accept its terms.

1. HOW DO WE PROCESS YOUR PERSONAL DATA?

In the table below you will find information about :

the purposes for which we process your personal data ("Purposes");
the relevant personal data ("Relevant personal data");
the legal basis for processing your personal data ("Legal basis");
how long we keep your personal data ("Retention Period").

Purposes	Relevant personal data	Legal basis	Retention period
Managing your registration on the platform (i.e. allowing you to create and customise your profile/user account on the Participation Platform).	Provided by you directly: We collect your Personal Data (i.e. name, email address and password, as well as information about your business project such as the name of the concept, launch date, number of shops opened, location, etc.) which is mandatory and necessary in order to create a user account on the Participation Platform and register you for the Contest.	Execution of the contract (Terms of Use)	Your Personal Data collected via the Participation Platform is retained until you delete your account on the Participation Platform. By closing your account, your Personal Data will be deleted immediately.
Management of your application (i.e. enabling you to participate in the Competition and providing you with all the necessary information).	Provided by you directly: We collect and process your Personal Data communicated in the context of your application file, namely: your surname/first name/civility; your e-mail address; your telephone number; any photographs/videos taken in the context of participation in the Competition; your data relating to your professional background; your data relating to your project and any other personal data that you wish to communicate to us, on the understanding that they will be immediately deleted if they are not necessary for the Competition.	Execution of the contract (competition rules).	Your Personal Data contained in your application will be retained for the duration of the Competition, including the prize-giving phase, and retained for an additional period of 5 (five) years corresponding to the limitation period in force in the event of a dispute by an Applicant in the Competition.
Management of your application (i.e. proposing partnerships and/or investment proposals at the end of the Competition).		Legitimate interest.
Management of messages, posts and uploads (i.e. enabling you to communicate and interact with other members of the Community on the Participation Platform, such as team members, mentors, jury members and/or the Competition organisers (e.g. messages exchanged with team members or invitations to join a team)).	Provided by you directly: We collect your Personal Data (i.e. your profile data: your name, email address, professional project and any information you wish to freely communicate) when you communicate, publish or upload it on the Participation Platform, in particular when you discuss or exchange messages with other members of the Community, when you publish announcements or use public discussion forums on the Participation Platform.	Execution of the contract (Terms of Use).	Information that you have shared with others (e.g., through messages, discussions or on walls/discussion forums) will remain visible after your account is closed, but will be anonymised. However, your profile may be displayed in search engine results, for example, until the cache is refreshed by the Applicant.
Technical incident management (i.e. managing the resolution of problems, access, data analysis, testing, research, investigation and analysis on the Participation Platform).	Provided by you directly: We may collect your Personal Data (i.e. your profile data: your name, email address, password and any information necessary to resolve your technical problem) when you report a problem with the Participation Platform. Provided by a third party : When you visit our website, Agorize collects information about the devices you use and the networks you are connected to. This technical information includes your IP address, login information, the bandwidth you use, the time of your visit, your browser type and version, your browser add-on types and versions, your operating system, information about your visit, including click stream display URLs, download/upload errors, the pages you visited, interactions between pages, and other connection data contained in our logs. Agorize collects this information through various technologies, such as cookies (see Cookie Policy).	Execution of the contract (these General Conditions of Use).	Until the technical incident is over.
Establishment, exercise or defence of a right in court	Personal data relevant to legal rights or disputes.	Legitimate interest of the data controllers to ensure the establishment, exercise or defence of legal claims or disputes.	Legal limitation period according to the type of legal claim or dispute.

2. WHO DO WE SHARE YOUR PERSONAL DATA WITH?

Your Personal Data can be accessed on the Participation Platform by :

Competition participants, mentors, jury members, visitors to the Participation Platform or users of third-party search engines who may view your profile (e.g. your name, photo, the Community, etc.) via the Participation Platform;
your team members, the Competition administrators and the members of the jury who may be able to consult your publications, messages and/or Application Form on the Participation Platform;
Unibail-Rodamco-Westfield group companies, to serve the purposes set out in this Privacy Policy;
Our subcontractors acting on our behalf and according to our instructions, such as Agorize SAS, the company hosting and maintaining the Participation Platform; 3CC, the service provider in charge of the design and communication of the Competition; and Good on you, which is in charge of training the Competition's jury on the evaluation criteria of sustainable development (ESG/sustainability) of the projects presented in the framework of the Competition.
Our subsequent subcontractors who may be technical service providers such as Amazon Web Services, Filestack, Algolia, Mail Chimp LLC / Mandrill and whose details can be found at: https://security.agorize.com/;
any competent authority or legal entity to respond to legal and/or regulatory requests;
any transferee, where the Personal Data forms part of the sale or transfer of all or part of our assets to another company;
our insurers, lawyers or other external advisers, and courts to enforce our rights and/or defend us.

3. TRANSFER OF YOUR PERSONAL DATA

In the context of the organisation and execution of the Competition and the registration and use of the Participation Platform, your Personal Data will not be collected and processed outside the European Economic Area.

4. HOW WE SECURE YOUR PERSONAL DATA

We will take appropriate technical and organisational measures to prevent unauthorised or unlawful processing of your Personal Data, or accidental loss, destruction or damage of your Personal Data by using our internal security procedures, which cover the storage, access and destruction of your Personal Data.

We have also chosen our subcontractors taking into account the technical and organisational measures to which they commit themselves.

As such, we have entered into data processing agreements with each of our service providers who act as data processors. These service providers are authorised to process your Personal Data only on our behalf and in accordance with our instructions, in accordance with the terms of this Privacy Policy.

However, we cannot control all the risks associated with the use of the Internet, and data security also depends on individual vigilance and the proper use of these technologies. We therefore urge you to remain vigilant about the potential risks inherent in the use of Internet services.

5. YOUR RIGHTS WITH REGARD TO YOUR PERSONAL DATA

In accordance with the Regulations applicable to the collection and processing of Personal Data, you have various rights depending on the situation concerned:

Right to access your Personal Data: You have the right to request confirmation that we are processing your Personal Data and, if so, to receive a copy;
Right to rectify your Personal Data: If the Personal Data we process is inaccurate, you have the right to request rectification;
Right to erase your Personal Data: You have the right to request the erasure of all or part of your Personal Data;
Right to object to the processing of your Personal Data: You have the right to object to the processing of your Personal Data. This means that you can ask us to stop processing your Personal Data until we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
Right to limit the processing of your Personal Data: You have the right to request the limitation of the processing of your Personal Data, in particular if you contest the accuracy of the data, the lawfulness of the processing or our necessity to process your Personal Data. In this case and if applicable, we will then process the Personal Data only for the establishment, exercise or defence of legal claims or, if necessary, for the protection of the rights of another natural or legal person, or for other reasons as provided for by the applicable laws;
Right to Data Portability: You have the right to receive a copy of the Personal Data you have provided to us in an interoperable format or, where appropriate and technically feasible, you may also request the transmission of that data directly to another controller;
Instructions on what to do with your Personal Information after your death: You have the right to give us instructions on how to handle your Personal Information after your death.

5.1 Exercising your rights

If you wish to exercise your rights and/or obtain any additional information, please contact the Organiser's Data Protection Officer at the following address: data.protection@urw.com or by post at 7 place du Chancelier Adenauer, 75116 PARIS, France.

In your request, please try to indicate as clearly as possible: (i) what Personal Data is concerned; and (ii) the right(s) you are exercising.

In order not to infringe the rights of third parties, we reserve the right, in case of reasonable doubt, to proceed to a preliminary verification of your identity by asking you :

additional information, such as your date of birth;
an identity document if there is reasonable doubt after the first step described above.

We will respond within 1 (one) month of receiving your request. This period may be extended by a further 2 (two) months, if necessary, taking into account the complexity and number of requests. In any event, we will inform you within 1 (one) month of receipt of your request if the deadline for response is extended, as well as the reasons for the extension.

5.2 Complaints

If you consider that the way in which we process your Personal Data breaches applicable data protection laws, you have the right to lodge a complaint with the competent supervisory authority.

6. LINKS

The Participation Platform contains links to other websites, including those of partner companies. These websites have their own privacy practices, for which we are not responsible. We invite you to consult these policies prior to any collection of your Personal Data on these third-party links.

7. UPDATES

This Privacy Policy was last updated on May 21st, 2023. We reserve the right to change this Privacy Policy at any time to reflect changes in legal requirements or our processing practices. Any such changes will be posted on the Participation Platform and will be effective upon posting.

If this change requires notification or your consent under the law applicable to the processing contemplated in the updated Privacy Policy, you will be notified and/or given the choice of whether or not to consent to us using your Personal Data in a different manner.

II- COOKIE POLICY

AGORIZE SAS (hereinafter together referred to as the "Data Controller" or "We") may install cookies or other tracers on your terminal in order to improve the interactivity of the https://grandprix.westfield.com website and its sub-domains (hereinafter referred to as the "Site").

1. What is a cookie?

On your first visit to the site, a consent window will open asking you for your preferences regarding cookies related to the following categories:

Audience monitoring (e.g. Matomo,..)
Social media (e.g. Facebook, Linkedin,...)
Marketing

All 3 categories are disabled by default. You can accept all, reject all or only accept certain categories of cookies.

Until you make a choice, the consent window will be displayed on any page visited and no cookies will be installed, except for technical cookies necessary for the operation of the platform.

Once the choice has been made, the cookies related to the selected categories will be installed on the next page visited or when the page is refreshed.

At any time, you can delete cookies, refuse the installation of new cookies or be warned before a new cookie is installed by configuring your browser using the instructions below.

By continuing to use our site, you agree to this cookie policy and to the use of cookies on your computer.

Please note that if you uninstall a cookie or refuse to accept cookies, you may not be able to use some of our services on our website.

2. What types of cookies do we collect?

We use the following types of cookies:

Technical session cookies for site management.
When you access the site, a session cookie and a "token" cookie with a unique encrypted session ID are sent to your computer. The session cookie then controls your access to the site for that session and is deleted once you close your browser or log out of the site. The token cookie controls your access to the site as an authenticated user, and is retained until you log out or for a maximum of 7 days. These cookies also allow us to identify your device and preferences when you return to our website, including custom features, language and regional preferences. These cookies are an essential component of the site's delivery system, and you will not be able to fully use our site if these cookies are not enabled. The information collected by these cookies is anonymous and is used for the sole purpose of improving your experience on our website.
Persistent technical cookies for site management.
If you register on the site and select the "Remember me" option, a persistent cookie is sent to your computer. This cookie is not deleted when you leave the site or close your browser, but is stored on your computer. This cookie contains an encrypted user identification code that identifies your computer on future visits and automatically logs you into the site. This is a functional cookie, designed to remember your preferences to enhance your experience on our site. It does not contain any personal information that can be used to identify you.
Third party cookies for audience monitoring. We may use Matomo, Google Tag Manager or Hotjar to monitor traffic to our site. When you visit our site, these programs install certain cookies that record statistical information about your visits to the site. We measure the number of visits, the number of pages viewed, and the activity of visitors to the site and how often they return. This allows us to improve our website and its operation, for example, by ensuring that users find their way around intuitively. These cookies do not record any personal information that can be used to identify you.
Third-party cookies for marketing. If marketing tools are set on the platform, these cookies will be used to send you communications. (disabled by default).
Third party cookies for social media. If the Platform allows you to register using single sign-on connectivity from social networks, we will use the information stored in these cookies to authenticate you.

3. What cookies are set?

Cookies installed by Agorize :

Cookie	Description	Refusal option	Duration
_agorize_session	Contains information about the browsing session and allows the user to access the site	N/A	Expires at the end of the session.
cookies_policy_accepted	Saves the user's cookie preferences	N/A	13 months
jwt_token	Contains a unique user ID after a successful login. This is a mandatory cookie to be able to navigate as a logged-in user	N/A	7 days
jwt_payload	Contains the user's information after a successful login. It is a mandatory cookie to be able to navigate as a logged-in user	N/A	7 days
remember_user_token	Keeps the user logged in if the "remember me" option has been selected	N/A	14 days
hide_profile_incomplete	Helps users to enter their information on the website	N/A	13 months

4. How do I delete cookies, be notified when they are set or configure my browser?

Click here to change your cookie preferences

> Deleting cookies already installed on your computer.

You can delete cookies already on your computer by clearing the browser's cache. To learn more about how to delete cookies in Chrome, Firefox, Safari, Opera and Internet Explorer, click here.

5. How do you configure your browser to refuse cookies or to notify you when cookies are set?

All web browsers allow you to set your cookie preferences before browsing the Internet. To find out how to configure your web browser to refuse cookies or to be notified when cookies are set, click here.

If you have any questions about our Cookie Policy, please email us at privacy@agorize.com.